com.atlassian.jira.web.util
Class HostileAttachmentsHelper

java.lang.Object
  extended by com.atlassian.jira.web.util.HostileAttachmentsHelper
All Implemented Interfaces:
Serializable

public class HostileAttachmentsHelper
extends Object
implements Serializable

A tool for loading and encapsulating the local policy for which MIME Content Types and file extensions may contain active executable client-side content and which therefore should be treated carefully to avoid XSS attacks via uploading these files as attachments. Browsers use Content-Type headers and file extensions to decide whether to attempt to execute file in a client context. Examples include javascript in html and ActionScript in .swf (Flash) binaries. Since these runtimes have access to the client-side state of the browser, they represent a potential

Since:
v3.13
See Also:
Serialized Form

Field Summary
static String DELIMITER_REGEX
          File extensions and content types in the config file are parsed from a list of items delimited by this regex.
 
Constructor Summary
HostileAttachmentsHelper()
           
 
Method Summary
 boolean isExecutableContentType(String contentType)
          Determines if the given String is a MIME Content Type denoting client-executable active content such that if the browser opens the file, its execution could have access to the browser DOM etc.
 boolean isExecutableFileExtension(String name)
          Determines if the given String has an extension denoting a client-executable active content type such that if the browser opens the file, its execution could have access to the browser DOM etc.
 void loadConfiguration()
          Loads the configuration of what are executable file extensions and content types from the default configuration file, CONFIG_FILE.
 
Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
 

Field Detail

DELIMITER_REGEX

public static final String DELIMITER_REGEX
File extensions and content types in the config file are parsed from a list of items delimited by this regex.

See Also:
Constant Field Values
Constructor Detail

HostileAttachmentsHelper

public HostileAttachmentsHelper()
Method Detail

loadConfiguration

public void loadConfiguration()
                       throws IOException
Loads the configuration of what are executable file extensions and content types from the default configuration file, CONFIG_FILE.

Throws:
IOException - if there is a problem loading from the default configuration file.

isExecutableFileExtension

public boolean isExecutableFileExtension(String name)
Determines if the given String has an extension denoting a client-executable active content type such that if the browser opens the file, its execution could have access to the browser DOM etc. Examples include .html, .svg and .swf. Note the check is case insensitive.

Parameters:
name - the file name.
Returns:
true only if the name has one of the configured extensions.

isExecutableContentType

public boolean isExecutableContentType(String contentType)
Determines if the given String is a MIME Content Type denoting client-executable active content such that if the browser opens the file, its execution could have access to the browser DOM etc. E.g. text/html Note the check is case insensitive.

Parameters:
contentType - the MIME Content Type string.
Returns:
true only if the given contentType is one of the configured executable Content Types.


Copyright © 2002-2008 Atlassian. All Rights Reserved.